Meanwhile, several training techniques [1]}, [2]} have been proposed to derive a more robust embedding model against the perturbations. On the one hand, data augmentation methods transform a single image [3]} or combine multiple images [4]}, [5]} to create more training samples at pixel level. However, these methods cannot create new information which is not included in the given data [1]}. On the other hand, adversarial training methods such as projected gradient descent (PGD) [7]}, AugGAN [8]} are used to find the perturbed images to confuse the model, i.e., predicting an incorrect label, as the additional training samples. However, these methods usually require numerous iterations to generate the adversarial examples by optimizing a predefined adversarial loss, which is computationally intensive. Besides, a clear trade-off has been shown between the accuracy of a classifier and its robustness against adversarial examples [2]}.
